Detection rules › Splunk

Unusual HTTP Download (Sysmon)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

Detects possible malicious download which was made using a browser or wget over the http or https protocol.

MITRE ATT&CK coverage

Event coverage

ProviderEventTitle
SysmonEvent ID 3Network connection
SysmonEvent ID 15FileCreateStreamHash

Rule body yaml

id: '1045.1073'
title: Unusual HTTP Download
description: Detects possible malicious download which was made using a browser or
  wget over the http or https protocol.
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` ((EventCode=3 (protocol="https"
  OR protocol="http"))) OR (EventCode=15 AND ("chrome.exe"OR "firefox.exe" OR "iexplorer.exe"
  OR "opera.exe" OR "MicrosoftEdge.exe"))| table _time, host, user, host, dest_ip,
  src_ip, dvc, tag, process_*, event_id, dest_port, src_port, dvc_nt_host, signature,
  user, direction, protocol| bin span=60s | stats values(*) as * by _time, host |
  table _time, host, user, dest_ip, dest_port, src_ip, src_port, event_id, process_id,
  process_name, process_path, signature, direction, protocol `hec_collect`'
techniques:
- command-and-control:ingress tool transfer
- command-and-control:application layer protocol:web protocols
technique_id:
- T1105
- T1071.001
data_category:
- Windows Sysmon
references: null

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_sysmon` ((EventCode=3 (protocol="https" OR protocol="http"))) OR (EventCode=15 AND ("chrome.exe"OR "firefox.exe" OR "iexplorer.exe" OR "opera.exe" OR "MicrosoftEdge.exe"))

Stage 2: table

| table _time, host, user, host, dest_ip, src_ip, dvc, tag, process_*, event_id, dest_port, src_port, dvc_nt_host, signature, user, direction, protocol

Stage 3: bucket

| bin span=60s

Stage 4: stats

| stats values(*) as * by _time, host

Stage 5: table

| table _time, host, user, dest_ip, dest_port, src_ip, src_port, event_id, process_id, process_name, process_path, signature, direction, protocol `hec_collect`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 15 corpus 4 (splunk 4)
  • 3 corpus 21 (splunk 14, kusto 5, chronicle 2)
protocoleq
  • "http"
  • "https"

Search terms

Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.

StageTerm
1"chrome.exe"
1"firefox.exe"
1"iexplorer.exe"
1"opera.exe"
1"MicrosoftEdge.exe"